HTTPヘッダー一覧

Cache-Control   (両方)
     How long this may be reused and by whom. max-age=31536000, immutable for a fingerprinted asset; no-store for anything private. "no-cache" does not mean do not cache — it means revalidate before reuse, which is the single most misread value in HTTP.

ETag   (レスポンス)
     A version tag for the body. The browser sends it back in If-None-Match and a match answers 304 with no body. Cheaper than Last-Modified because it does not depend on clocks.

Last-Modified   (レスポンス)
     When the body last changed, to the second. Paired with If-Modified-Since. One-second resolution means a file changed twice in a second can be served stale.

Vary   (レスポンス)
     Which request headers change this response, so a cache does not serve the wrong one. Vary: Accept-Encoding is nearly always right; Vary: User-Agent nearly always destroys your hit rate.

Content-Type   (両方)
     What the bytes are. Wrong here and a browser refuses to act: an SVG as text/plain does not render, a .vtt as text/plain is ignored and the video plays with no captions and no error.

Content-Disposition   (レスポンス)
     inline to display, attachment to download. filename*=UTF-8''... is how a non-ASCII filename survives; the plain filename= parameter is ASCII only.

Content-Encoding   (レスポンス)
     The compression applied to the body — gzip, br, zstd. Not the character set, which goes in Content-Type.

Content-Length   (両方)
     The body size in bytes. Omitted when chunked; getting it wrong truncates or hangs the response.

Authorization   (リクエスト)
     Credentials. Bearer <token> for OAuth, Basic <base64 user:pass> for the old scheme. Never logged, and never in a URL where it would be.

WWW-Authenticate   (レスポンス)
     Sent with 401 to say which scheme to authenticate with. A 401 without it is incomplete, and some clients will not retry.

Set-Cookie   (レスポンス)
     Sets a cookie. Secure, HttpOnly and SameSite are the three that matter; without HttpOnly a script can read it, and without Secure it travels in the clear.

Cookie   (リクエスト)
     Cookies going back. Sent on every request to the origin, which is why a large cookie is a tax on every page load.

Strict-Transport-Security   (レスポンス)
     Forces HTTPS for this host for max-age seconds. includeSubDomains covers everything under it. Hard to undo — a long max-age set by mistake locks out a subdomain until it expires.

Content-Security-Policy   (レスポンス)
     What the page may load and run. The one header that actually stops cross-site scripting rather than reporting it. unsafe-inline in script-src gives most of the protection back.

X-Content-Type-Options   (レスポンス)
     nosniff: take Content-Type literally instead of guessing from the bytes. One value, no downside, and it closes a whole class of upload attacks.

X-Frame-Options   (レスポンス)
     DENY or SAMEORIGIN to stop the page being framed. Superseded by frame-ancestors in CSP, which is more expressive; send both while old browsers remain.

Referrer-Policy   (レスポンス)
     How much of the current URL is sent on to the next site. strict-origin-when-cross-origin is the modern default and keeps paths and query strings inside your own origin.

Permissions-Policy   (レスポンス)
     Which browser features this document and its frames may use — camera, geolocation, microphone. Replaces Feature-Policy.

Access-Control-Allow-Origin   (レスポンス)
     Which origin may read the response. A single origin or *, never a list. With credentials it may not be * — that pairing is the commonest CORS failure.

Access-Control-Allow-Credentials   (レスポンス)
     true lets the browser send cookies cross-origin. Requires an exact origin in Allow-Origin, not a wildcard.

Access-Control-Allow-Methods   (レスポンス)
     Which methods the preflight permits. Only consulted on the OPTIONS preflight, not on the real request.

Access-Control-Allow-Headers   (レスポンス)
     Which request headers the preflight permits. A custom header the client sends must be listed here or the request never leaves the browser.

Access-Control-Max-Age   (レスポンス)
     How long a preflight result may be cached. Browsers cap it well below what you set — Chrome at 2 hours.

Origin   (リクエスト)
     Where the request came from, sent on cross-origin requests and all POSTs. What a CORS check and a CSRF check both look at.

Accept   (リクエスト)
     What the client can take back, as media types with quality values. Content negotiation happens here, and Vary has to name it if you use it.

Accept-Encoding   (リクエスト)
     Which compressions the client understands. Respond compressed only with one of these, and add Vary: Accept-Encoding.

Accept-Language   (リクエスト)
     Preferred languages with weights. A hint, not an instruction — and a poor way to pick a locale on its own, because it reflects the browser install and not the reader.

User-Agent   (リクエスト)
     The client naming itself, in a string that has been a fiction since roughly 1996. Feature-detect instead; it is frozen or reduced in modern browsers anyway.

Range   (リクエスト)
     Ask for part of the body — bytes=0-1023. What makes seeking in a video and resuming a download possible; the server answers 206 with Content-Range.

Retry-After   (レスポンス)
     Sent with 429 or 503 to say when to come back, in seconds or as a date. Answering 429 without it leaves the client guessing, and it will guess badly.

Location   (レスポンス)
     Where to go, with a 3xx, or where the thing just created lives, with a 201.

Link   (レスポンス)
     Relationships as a header rather than in the markup — rel=preload, rel=canonical, pagination. Read before the body arrives, which is the point.

X-Forwarded-For   (リクエスト)
     The client address as a proxy saw it. Trivially forged unless every hop is yours, so never use it for anything that matters without knowing your proxy chain.

Forwarded   (リクエスト)
     The standard version of the X-Forwarded-* family, carrying for, proto and host in one. Less widely implemented, better specified.

Server-Timing   (レスポンス)
     Timings from the server, shown in the browser devtools next to the network timings. Costs nothing and answers "is it us or the network".

Idempotency-Key   (リクエスト)
     A client-chosen key so that retrying a POST does not charge the card twice. Not a standard header, and universal anyway in payment APIs.